kryptheon-night 0.1.36 → 0.1.38

package/engine.sql

@@ -261,6 +261,9 @@ RETURNS jsonb LANGUAGE sql STABLE AS $$
                'def', pg_get_functiondef(p.oid),
                'args', pg_get_function_identity_arguments(p.oid),
                'default_acl', p.proacl IS NULL,
+               -- Installed by an extension, not written by the app (schema.js readFunctions).
+               'from_extension', EXISTS (SELECT 1 FROM pg_depend d
+                                          WHERE d.classid = 'pg_proc'::regclass AND d.objid = p.oid AND d.deptype = 'e'),
                -- Whether the app can call it at all (schema.js readFunctions).
                'client_callable', CASE WHEN EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'anon')
                                             AND EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'authenticated')
@@ -365,7 +368,17 @@ BEGIN
                               FROM pg_policies p
                              WHERE p.schemaname = 'storage' AND p.tablename = 'objects'
                                AND p.cmd IN ('SELECT', 'ALL')
-                               AND position(quote_literal(b.id::text) IN coalesce(p.qual, '')) > 0)
+                               AND position(quote_literal(b.id::text) IN coalesce(p.qual, '')) > 0),
+              -- The rules for putting files in and taking them out (schema.js BUCKETS_QUERY).
+              'writeRules', (SELECT coalesce(jsonb_agg(jsonb_build_object(
+                                     'name', p.policyname::text,
+                                     'roles', to_jsonb(p.roles::text[]),
+                                     'qual', p.qual,
+                                     'with_check', p.with_check) ORDER BY p.policyname), '[]'::jsonb)
+                              FROM pg_policies p
+                             WHERE p.schemaname = 'storage' AND p.tablename = 'objects'
+                               AND p.cmd IN ('INSERT', 'UPDATE', 'DELETE', 'ALL')
+                               AND position(quote_literal(b.id::text) IN coalesce(p.qual, '') || ' ' || coalesce(p.with_check, '')) > 0)
             ) ORDER BY b.id), '[]'::jsonb)
        FROM storage.buckets b $q$ INTO found;
   RETURN found;
@@ -513,6 +526,7 @@ DECLARE
   rest text;
   narrowing jsonb;
   no_rule boolean;
+  writers jsonb;
   found jsonb := '[]'::jsonb;
 BEGIN
   FOR b IN SELECT * FROM jsonb_array_elements(coalesce(buckets, '[]'::jsonb)) LOOP
@@ -528,12 +542,23 @@ BEGIN
         narrowing := narrowing || to_jsonb(rule->>'name');
       END IF;
     END LOOP;
+    -- Rules for putting files in or taking them out that only signed-in
+    -- people pass (scan.js bucketsOf; blind round 15).
+    writers := '[]'::jsonb;
+    IF jsonb_array_length(coalesce(b->'readRules', '[]'::jsonb)) = 0 THEN
+      SELECT coalesce(jsonb_agg(w->>'name' ORDER BY ord), '[]'::jsonb) INTO writers
+        FROM jsonb_array_elements(coalesce(b->'writeRules', '[]'::jsonb)) WITH ORDINALITY AS e(w, ord)
+       WHERE (NOT (coalesce(w->'roles', '[]'::jsonb) ? 'anon' OR coalesce(w->'roles', '[]'::jsonb) ? 'public')
+              OR (coalesce(w->>'qual', '') || ' ' || coalesce(w->>'with_check', '')) ~* '\mauth\s*\.\s*(uid|jwt)\s*\(')
+         AND (coalesce(w->>'qual', '') || ' ' || coalesce(w->>'with_check', '')) ~* '\mfrom\s+';
+    END IF;
     no_rule := jsonb_array_length(coalesce(b->'readRules', '[]'::jsonb)) = 0
-      AND (b->>'name') ~* '(^|[-_.])(exports?|private|documents?|docs|invoices?|contracts?|backups?|reports?|receipts?|statements?|payouts?|evidence|kyc|passports?|medical|records?|confidential|internal|secrets?|attachments?)([-_.]|$)';
+      AND ((b->>'name') ~* '(^|[-_.])(exports?|private|documents?|docs|invoices?|contracts?|backups?|reports?|receipts?|statements?|payouts?|evidence|kyc|passports?|medical|records?|confidential|internal|secrets?|attachments?)([-_.]|$)'
+           OR jsonb_array_length(writers) > 0);
     IF jsonb_array_length(narrowing) > 0 OR no_rule THEN
       found := found || jsonb_build_array(jsonb_build_object(
         'kind', 'bucket', 'table', b->>'name', 'bucket', b->>'id',
-        'rules', narrowing, 'noRule', no_rule, 'columns', '[]'::jsonb));
+        'rules', narrowing, 'noRule', no_rule, 'writers', writers, 'columns', '[]'::jsonb));
     END IF;
   END LOOP;
   RETURN found;
@@ -2899,7 +2924,14 @@ BEGIN
         jsonb_build_array(lowest) || coalesce((
           SELECT jsonb_agg(l ORDER BY pos DESC)
             FROM jsonb_array_elements_text(labels) WITH ORDINALITY AS e(l, pos)
-           WHERE l <> lowest AND l !~* 'owner|admin|super|root'), '[]'::jsonb));
+           WHERE l <> lowest AND l !~* 'owner|admin|super|root'), '[]'::jsonb),
+        -- The role at the top: an owner if there is one, else the first in charge.
+        'top', coalesce(
+          (SELECT l FROM jsonb_array_elements_text(labels) WITH ORDINALITY AS e(l, pos) WHERE l ~* 'owner' ORDER BY pos LIMIT 1),
+          (SELECT l FROM jsonb_array_elements_text(labels) WITH ORDINALITY AS e(l, pos) WHERE l ~* 'owner|admin|super|root' ORDER BY pos LIMIT 1)),
+        -- Every role in charge, in the order the list gives them.
+        'inCharge', coalesce((SELECT jsonb_agg(l ORDER BY pos) FROM jsonb_array_elements_text(labels) WITH ORDINALITY AS e(l, pos)
+                               WHERE l ~* 'owner|admin|super|root'), '[]'::jsonb));
     END IF;
   END LOOP;
   RETURN NULL;
@@ -2965,7 +2997,7 @@ BEGIN
     CONTINUE WHEN jsonb_array_length(keys) = 0 OR __KN__.alone_unique(tab, person);
     found := found || jsonb_build_array(jsonb_build_object(
       'table', tab, 'person', person, 'role', role_->>'column', 'lowest', role_->>'lowest',
-      'roleType', role_->>'type', 'ladder', role_->'ladder', 'keys', keys));
+      'roleType', role_->>'type', 'ladder', role_->'ladder', 'top', role_->'top', 'inCharge', role_->'inCharge', 'keys', keys));
   END LOOP;
   -- A table named for members first: it is the one a team rule asks.
   SELECT coalesce(jsonb_agg(m ORDER BY (m->'table'->>'name') !~* 'member', at), '[]'::jsonb) INTO found
@@ -3044,7 +3076,8 @@ DECLARE
     '"?(,[^}'']*)?\}''::("?[A-Za-z0-9_$]+"?\.)?"?' || type_name || '"?\[\]';
   in_helper_list text := '(\mIN\s*\(|ARRAY\[)[^])]*' || label;
   -- A takeover is an UPDATE too (tamper.js COMMAND).
-  command text := CASE what WHEN 'add' THEN 'INSERT' WHEN 'change' THEN 'UPDATE' WHEN 'delete' THEN 'DELETE' WHEN 'takeover' THEN 'UPDATE' END;
+  command text := CASE what WHEN 'add' THEN 'INSERT' WHEN 'change' THEN 'UPDATE' WHEN 'delete' THEN 'DELETE'
+                            WHEN 'takeover' THEN 'UPDATE' WHEN 'promote' THEN 'UPDATE' END;
   policy jsonb;
   body text;
 BEGIN
@@ -3116,6 +3149,9 @@ DECLARE
   before_all jsonb;
   below jsonb;
   listed boolean;
+  their_team text;
+  plain_ bigint;
+  label_ text;
 BEGIN
   FOR member IN SELECT * FROM jsonb_array_elements(__KN__.memberships(tables)) LOOP
     SELECT (s->>'attempt')::integer INTO shape
@@ -3239,6 +3275,17 @@ BEGIN
         moves := moves || jsonb_build_array(jsonb_build_object('what', 'takeover', 'anyRole', true,
           'statement', 'UPDATE ' || target || ' SET ' || __KN__.always_quote(member->>'person') || ' = '
             || quote_literal(__KN__.user_b()) || ' WHERE ' || array_to_string(where_, ' AND ')));
+        -- Their own membership row, given the role at the top (tamper.js;
+        -- blind round 15: a viewer set their own role to 'owner').
+        IF member->>'top' IS NOT NULL THEN
+          where_ := ARRAY[__KN__.always_quote(member->>'person') || ' = ' || quote_literal(__KN__.user_b())];
+          FOR name IN SELECT jsonb_object_keys(pointed) ORDER BY 1 LOOP
+            where_ := where_ || (__KN__.always_quote(name) || ' = ' || quote_literal(pointed->>name));
+          END LOOP;
+          moves := moves || jsonb_build_array(jsonb_build_object('what', 'promote', 'anyRole', true,
+            'statement', 'UPDATE ' || target || ' SET ' || __KN__.always_quote(member->>'role') || ' = '
+              || quote_literal(member->>'top') || ' WHERE ' || array_to_string(where_, ' AND ')));
+        END IF;
       END IF;
 
       -- Adding a row to the team, said only of a role whose own name says it
@@ -3322,12 +3369,59 @@ BEGIN
             'rlsEnabled', coalesce((tab->>'rlsEnabled')::boolean, false))
             || CASE WHEN can ? 'takeover'
                  THEN jsonb_build_object('takeover', true, 'personColumn', member->>'person')
+                 ELSE '{}'::jsonb END
+            || CASE WHEN can ? 'promote'
+                 THEN jsonb_build_object('promote', true, 'toRole', member->>'top')
                  ELSE '{}'::jsonb END);
           EXIT;
         END IF;
         IF NOT listed THEN below := below || to_jsonb(role_); END IF;
       END LOOP;
 
+      -- In charge of their OWN team, reading the first person's (tamper.js;
+      -- blind round 15: a read rule's role check not tied to the row's
+      -- organization let an admin of any organization read every one). Only
+      -- what the role added counts.
+      their_team := NULL;
+      IF EXISTS (SELECT 1 FROM jsonb_object_keys(pointed)) THEN
+        SELECT string_agg(__KN__.always_quote(k) || ' = ' || quote_literal(pointed->>k), ' AND ' ORDER BY k)
+          INTO their_team FROM jsonb_object_keys(pointed) k;
+      ELSIF owner IS NOT NULL THEN
+        their_team := __KN__.always_quote(owner) || ' = ' || quote_literal(__KN__.user_a());
+      END IF;
+      IF their_team IS NOT NULL AND jsonb_array_length(coalesce(member->'inCharge', '[]'::jsonb)) > 0 THEN
+        look := 'SELECT 1 FROM ' || target || ' WHERE ' || their_team;
+        plain_ := __KN__.rows_moved(__KN__.try_write('authenticated', __KN__.user_b(), look));
+        FOR label_ IN SELECT jsonb_array_elements_text(member->'inCharge') LOOP
+          finding_key := 'elevated:' || (tab->>'name') || ':' || label_;
+          now_ := __KN__.rows_moved(__KN__.try_write_joined('authenticated', __KN__.user_b(), look,
+            'UPDATE ' || __KN__.always_quote(source) || '.' || __KN__.always_quote(member->'table'->>'name') || ' SET '
+              || __KN__.always_quote(member->>'role') || ' = ' || quote_literal(label_) || ' WHERE '
+              || __KN__.always_quote(member->>'person') || ' = ' || quote_literal(__KN__.user_b())));
+          IF plain_ IS NULL OR now_ IS NULL THEN
+            blocked := blocked || jsonb_build_array(jsonb_build_object('table', tab->>'name', 'key', finding_key,
+              'why', 'as "' || label_ || '" in their own ' || parent || ' row: reading it failed'));
+            EXIT;
+          END IF;
+          completed := completed || to_jsonb(finding_key);
+          IF now_ > plain_ THEN
+            findings := findings || jsonb_build_array(jsonb_build_object(
+              'kind', 'crossed',
+              'table', tab->>'name',
+              'owner', coalesce(owner, (SELECT k FROM jsonb_object_keys(pointed) k ORDER BY k LIMIT 1)),
+              'tenant', owner IS NULL,
+              'readable', now_ - plain_,
+              'asRole', label_,
+              'via', member->'table'->>'name',
+              'roleColumn', member->>'role',
+              'parent', parent,
+              'columns', coalesce((SELECT jsonb_agg(c->>'name') FROM jsonb_array_elements(tab->'columns') c), '[]'::jsonb),
+              'rlsEnabled', coalesce((tab->>'rlsEnabled')::boolean, false)));
+            EXIT;
+          END IF;
+        END LOOP;
+      END IF;
+
       -- Reading what a member should not see, said only of a table holding a
       -- secret. Every role not in charge, from the lowest up; the first that
       -- can read is the one named.
@@ -3852,6 +3946,26 @@ RETURNS jsonb LANGUAGE sql IMMUTABLE AS $$
      AND m.name IS NOT NULL;
 $$;
 
+/* Tables nobody can add a row to: every permissive rule for adding rows is a
+   bare INSERT rule, with neither USING nor WITH CHECK, which Postgres reads as
+   "no" (scan.js noInsertsOf; blind round 15's tickets_insert). */
+CREATE OR REPLACE FUNCTION __KN__.no_insert_findings(plan jsonb)
+RETURNS jsonb LANGUAGE sql IMMUTABLE AS $$
+  WITH rules AS (
+    SELECT p->>'table_name' AS t, p->>'name' AS n,
+           upper(coalesce(p->>'cmd', 'ALL')) = 'INSERT' AND p->>'qual' IS NULL AND p->>'with_check' IS NULL AS bare
+      FROM jsonb_array_elements(coalesce(plan->'policies', '[]'::jsonb)) p
+     WHERE upper(coalesce(p->>'permissive', 'PERMISSIVE')) = 'PERMISSIVE'
+       AND upper(coalesce(p->>'cmd', 'ALL')) IN ('INSERT', 'ALL')
+  ), per AS (
+    SELECT t, jsonb_agg(n ORDER BY n COLLATE "C") FILTER (WHERE bare) AS names, bool_and(bare) AS all_bare
+      FROM rules GROUP BY t
+  )
+  SELECT coalesce(jsonb_agg(jsonb_build_object('kind', 'noinsert', 'table', t, 'rules', names, 'columns', '[]'::jsonb)
+                            ORDER BY t COLLATE "C"), '[]'::jsonb)
+    FROM per WHERE all_bare;
+$$;
+
 /* The ones of those that still take an empty value. */
 CREATE OR REPLACE FUNCTION __KN__.empty_choice_findings(plan jsonb)
 RETURNS jsonb LANGUAGE sql IMMUTABLE AS $$
@@ -3954,6 +4068,35 @@ BEGIN
   RETURN out_;
 END $$;
 
+/* The tables whose rules decide who is asking from a setting the app's own
+   server sets - current_setting('app.tenant_id') - not from a Supabase
+   sign-in: NOT checked, said with the settings (scan.js serverIdentityOf,
+   blind round 13). */
+CREATE OR REPLACE FUNCTION __KN__.server_identity(plan jsonb)
+RETURNS jsonb LANGUAGE sql IMMUTABLE AS $$
+  WITH texts AS (
+    SELECT p->>'table_name' AS t, coalesce(p->>'qual', '') || ' ' || coalesce(p->>'with_check', '') AS x
+      FROM jsonb_array_elements(coalesce(plan->'policies', '[]'::jsonb)) p
+  ), settings AS (
+    SELECT t, (regexp_matches(x, 'current_setting\s*\(\s*''([^'']+)''', 'gi'))[1] AS s
+      FROM texts
+     WHERE x !~* '\mauth\s*\.\s*(uid|jwt|role|email)\s*\(|request\.jwt'
+  ), per AS (
+    SELECT t, array_agg(DISTINCT 'current_setting(''' || s || ''')' ORDER BY 'current_setting(''' || s || ''')') AS q
+      FROM settings
+     WHERE s !~* '^request\.'
+     GROUP BY t
+  )
+  SELECT coalesce(jsonb_agg(jsonb_build_object(
+           'table', t,
+           'why', 'its rules decide who is asking with '
+                  || CASE WHEN cardinality(q) < 2 THEN q[1]
+                          ELSE array_to_string(q[1:cardinality(q) - 1], ', ') || ' and ' || q[cardinality(q)] END,
+           'identity', true)
+         ORDER BY t COLLATE "C"), '[]'::jsonb)
+    FROM per;
+$$;
+
 /* The app's functions read and never called (scan.js notCalledOf). */
 CREATE OR REPLACE FUNCTION __KN__.not_called(plan jsonb, findings jsonb)
 RETURNS jsonb LANGUAGE sql IMMUTABLE AS $$
@@ -3966,6 +4109,7 @@ RETURNS jsonb LANGUAGE sql IMMUTABLE AS $$
   SELECT coalesce(jsonb_agg(DISTINCT (fn->>'name') COLLATE "C" ORDER BY (fn->>'name') COLLATE "C"), '[]'::jsonb)
     FROM jsonb_array_elements(coalesce(plan->'functions', '[]'::jsonb)) fn, rules
    WHERE coalesce((fn->>'client_callable')::boolean, false)
+     AND NOT coalesce((fn->>'from_extension')::boolean, false)
      AND (fn->>'name') NOT IN (SELECT name FROM named)
      AND NOT __KN__.calls_function(rules.text_, fn->>'name');
 $$;
@@ -4098,6 +4242,7 @@ BEGIN
       || __KN__.search_path_findings(plan)
       || refused
       || __KN__.empty_choice_findings(plan)
+      || __KN__.no_insert_findings(plan)
       || __KN__.bucket_findings(plan->'buckets');
 
     -- Everything genuinely attacked, so a re-check can tell a finding that was
@@ -4116,11 +4261,15 @@ BEGIN
               || coalesce((SELECT jsonb_agg('conflict:' || (f->>'name'))
                              FROM jsonb_array_elements(coalesce(plan->'functions', '[]'::jsonb)) f), '[]'::jsonb)
               || coalesce((SELECT jsonb_agg('nullcheck:' || (x->>'table') || ':' || (x->'column'->>'name'))
-                             FROM jsonb_array_elements(__KN__.one_of_columns(plan)) x), '[]'::jsonb);
+                             FROM jsonb_array_elements(__KN__.one_of_columns(plan)) x), '[]'::jsonb)
+              || coalesce((SELECT jsonb_agg(DISTINCT 'noinsert:' || (p->>'table_name'))
+                             FROM jsonb_array_elements(coalesce(plan->'policies', '[]'::jsonb)) p
+                            WHERE upper(coalesce(p->>'cmd', 'ALL')) IN ('INSERT', 'ALL')), '[]'::jsonb);
 
     -- And everything that was not. Said out loud, never left out: a table
     -- nothing could be put into reads exactly like a table nothing got out of.
     not_checked := coalesce(sown->'skipped', '[]'::jsonb)
+                || __KN__.server_identity(plan)
                 || coalesce(seen->'blocked', '[]'::jsonb)
                 || coalesce(wrote->'blocked', '[]'::jsonb)
                 || coalesce(ranked->'blocked', '[]'::jsonb)

package/finding.js

@@ -126,12 +126,15 @@ function severityOf(finding, contents) {
     // because the app is broken for whoever it fails for, but not a break-in.
     return 'HIGH';
   }
+  // A member who can make themselves the owner: never the design, and the
+  // owner's reach is everything - the one role finding that is confirmed.
+  if (finding.kind === 'role' && finding.promote) return 'CRITICAL';
   if (finding.kind === 'role' || finding.kind === 'teamread' || finding.kind === 'bucket') {
     // Something to check, never a confirmed break: whether a viewer may edit,
     // or a bucket may be public, is the owner's decision. So never CRITICAL.
     return 'HIGH';
   }
-  if (finding.kind === 'conflict' || finding.kind === 'searchpath' || finding.kind === 'nullcheck') {
+  if (finding.kind === 'conflict' || finding.kind === 'searchpath' || finding.kind === 'nullcheck' || finding.kind === 'noinsert') {
     // Read from how a function or a column is declared. A refused upsert
     // breaks the app for whoever calls it; an open search_path and an empty
     // value are for the owner to weigh. None of them hands a row to anybody.
@@ -373,10 +376,17 @@ function headlineFor(finding) {
   if (finding.kind === 'nullcheck') {
     return 'Your ' + finding.table + ' table accepts rows with no ' + finding.column + ' at all.';
   }
+  if (finding.kind === 'noinsert') {
+    return 'Nobody can add a row to your ' + finding.table + ' table: its rule for adding rows checks nothing, and Postgres reads that as no.';
+  }
   if (finding.kind === 'role' && finding.takeover) {
     return capital(aRole(finding.who)) + ' in ' + aOne(finding.parent) + ' can take another member\'s place in your ' +
       finding.table + ' table - and with it their role.';
   }
+  if (finding.kind === 'role' && finding.promote) {
+    return capital(aRole(finding.who)) + ' in ' + aOne(finding.parent) + ' can make themselves ' + aRole(finding.toRole) +
+      ' by changing their own row in your ' + finding.table + ' table.';
+  }
   if (finding.kind === 'role') {
     const order = ['delete', 'change', 'add'];
     const does = order.filter((what) => (finding.can || []).includes(what)).map((what) => WRITE_WORDS[what]);
@@ -387,6 +397,9 @@ function headlineFor(finding) {
     return capital(aRole(finding.who)) + ' in ' + aOne(finding.parent) + ' can read your ' + finding.table +
       ' table, which holds ' + listOf(finding.secrets || []) + '.';
   }
+  if (finding.kind === 'bucket' && finding.noRule && (finding.writers || []).length) {
+    return 'Your ' + finding.table + ' storage bucket is public, though only signed-in members may put files in it.';
+  }
   if (finding.kind === 'bucket' && finding.noRule) {
     return 'Your ' + finding.table + ' storage bucket is public, and its name says its files are not for everyone.';
   }
@@ -399,6 +412,10 @@ function headlineFor(finding) {
   // The table name goes in front of the sentence rather than inside it. Put
   // inside, a table called `customers` produced "One customer can read another
   // customer's customers", which is the kind of line that loses a reader.
+  if (finding.asRole) {
+    return capital(aRole(finding.asRole)) + ' of any ' + oneOf(finding.parent) + ' can read every other ' + oneOf(finding.parent) +
+      '\'s rows in your ' + finding.table + ' table.';
+  }
   if (finding.tenant) return 'Your ' + finding.table + ' table lets a signed-in user read another organization\'s rows.';
   return 'Your ' + finding.table + ' table lets one customer read another one\'s rows.';
 }
@@ -491,6 +508,19 @@ function bodyFor(finding, contents) {
     );
   }
 
+  if (finding.kind === 'role' && finding.promote) {
+    // Never the design: a member who can raise their own role has every
+    // right the top role has, in every table that trusts the role.
+    const place = oneOf(finding.parent);
+    return (
+      'I put one of my fake people into the other one\'s ' + place + ' as ' + aRole(finding.who) +
+      ' in ' + finding.via + '.' + finding.roleColumn + ' and, signed in as them, changed ' + finding.via + '.' +
+      finding.roleColumn + ' on their own membership row to "' + finding.toRole + '" - on a copy of your app. It was ' +
+      'undone straight away. From then on they would have every right ' + aRole(finding.toRole) + ' has, in every ' +
+      'table and function that trusts that role.'
+    );
+  }
+
   if (finding.kind === 'role') {
     // Said as what was done, and then whose decision it is: a viewer who may
     // edit is a hole in one app and the design of another.
@@ -535,8 +565,13 @@ function bodyFor(finding, contents) {
     return (
       'In Supabase Storage the bucket "' + finding.bucket + '" is set to public, so anyone with a ' +
       'file\'s link can download it without logging in - the rules on storage.objects are not asked. ' +
-      'No rule says who may read it, but its name says what it holds, and that does not sound like ' +
-      'something for everyone. I only read the bucket\'s setting and its rules; I did not open or list ' +
+      ((finding.writers || []).length
+        ? 'No rule says who may read it, but ' + listOf((finding.writers || []).map((r) => '"' + r + '"')) +
+          ' let only signed-in members put files in or take them out - so the app treats these files as its ' +
+          'members\' own, while anyone holding a link can download them. '
+        : 'No rule says who may read it, but its name says what it holds, and that does not sound like ' +
+          'something for everyone. ') +
+      'I only read the bucket\'s setting and its rules; I did not open or list ' +
       'any file. Whether it should be public is yours to say.'
     );
   }
@@ -587,6 +622,17 @@ function bodyFor(finding, contents) {
       'anything; this is read from how the column is declared.'
     );
   }
+  if (finding.kind === 'noinsert') {
+    return (
+      'Row level security is on for ' + finding.table + ', and the only ' + ((finding.rules || []).length === 1 ? 'rule' : 'rules') +
+      ' for adding rows (' + listOf((finding.rules || []).map((r) => '"' + r + '"')) + ') ' +
+      ((finding.rules || []).length === 1 ? 'has' : 'have') + ' neither USING nor WITH CHECK. A rule with no ' +
+      'expression is not "allow everything": Postgres treats it as false, so every INSERT - from the app, ' +
+      'and from any function that runs as the user - is refused with "new row violates row-level security ' +
+      'policy". If your app adds ' + finding.table + ' rows, that feature is broken for everyone. This is read ' +
+      'from how the rule is written; I did not insert anything.'
+    );
+  }
   if (finding.kind === 'privileged') {
     // Said as what is true, not as what was done - nothing was executed. The
     // reach is real; whether it is a mistake is the person's to say, so the
@@ -644,6 +690,17 @@ function bodyFor(finding, contents) {
       (holds ? ', including ' + holds : '') + '.'
     );
   }
+  if (finding.asRole) {
+    // Blind round 15: a role check in a read rule that was never tied to the
+    // row's own organization.
+    return (
+      'I made one of my fake people ' + aRole(finding.asRole) + ' of their own ' + oneOf(finding.parent) + ' (' + finding.via + '.' +
+      finding.roleColumn + ') and, signed in as them, asked for the other ' + oneOf(finding.parent) + '\'s rows in ' + finding.table +
+      ' and got ' + finding.readable + ' back' + (holds ? ', including ' + holds : '') + '. With an ordinary role they got none. ' +
+      'So anybody who is ' + aRole(finding.asRole) + ' anywhere - which in most apps means anybody who creates their own ' +
+      oneOf(finding.parent) + ' - can read every ' + oneOf(finding.parent) + '\'s rows here.'
+    );
+  }
   if (finding.tenant) {
     return (
       'Signed in as someone in a different organization, I asked for another organization\'s rows and got ' +
@@ -898,6 +955,23 @@ function fixPromptFor(finding) {
       '',
       'Then check every function that updates "' + finding.via + '" for the same thing.',
     ]
+    : finding.kind === 'role' && finding.promote
+    ? [
+      'My app has a security problem - a member can make themselves ' + aRole(finding.toRole) + '.',
+      '',
+      'In my database, a member of ' + aOne(finding.parent) + ' whose role in "' + finding.via + '"."' +
+        finding.roleColumn + '" is "' + finding.who + '" can update their own row in "' + finding.via + '" and set "' +
+        finding.roleColumn + '" to "' + finding.toRole + '". The rule only checks that the row is theirs, not what ' +
+        'they change in it. This was proved on a copy of the database.',
+      '',
+      'Fix the rules on "' + finding.via + '" that cover UPDATE or ALL: a member must never be able to change "' +
+        finding.roleColumn + '" on their own row. Let only the roles that manage the team (usually owner and admin) ' +
+        'change roles, checked in WITH CHECK as well as USING - for example with a helper that reads "' + finding.via +
+        '" for auth.uid() - and make sure nobody can raise anyone above their own role. If members need to edit ' +
+        'something else of their own, allow exactly those columns and not "' + finding.roleColumn + '".',
+      '',
+      'Then check every function that updates "' + finding.via + '" for the same thing.',
+    ]
     : finding.kind === 'role'
     ? [
       'My app may have a permissions problem - please check it rather than assume it.',
@@ -943,7 +1017,11 @@ function fixPromptFor(finding) {
       'My app may have a storage problem - please check it rather than assume it.',
       '',
       'The Supabase Storage bucket "' + finding.bucket + '" is public. Anyone with a file\'s URL can ' +
-        'download it without logging in' + (finding.noRule
+        'download it without logging in' + (finding.noRule && (finding.writers || []).length
+        ? ', and no rule on storage.objects says who may read it - though ' +
+          listOf((finding.writers || []).map((r) => '"' + r + '"')) + ' let only signed-in members upload or delete ' +
+          'its files, which suggests they are not meant for everyone.'
+        : finding.noRule
         ? ', and no rule on storage.objects says who may read it - its name suggests its files are not ' +
           'meant for everyone.'
         : ', and the storage.objects ' +
@@ -1019,6 +1097,24 @@ function fixPromptFor(finding) {
         'the right value is), then ALTER TABLE "' + finding.table + '" ALTER COLUMN "' + finding.column +
         '" SET NOT NULL. Change nothing else.',
     ]
+    : finding.kind === 'noinsert'
+    ? [
+      'My app may have a bug - please check it rather than assume it.',
+      '',
+      'In my database, the rule' + ((finding.rules || []).length === 1 ? ' ' : 's ') +
+        listOf((finding.rules || []).map((r) => '"' + r + '"')) + ' on "' + finding.table + '" for INSERT ' +
+        ((finding.rules || []).length === 1 ? 'has' : 'have') + ' no WITH CHECK, and there is no other rule that ' +
+        'allows adding rows. Postgres treats a missing check as false, so nobody can add a row to "' + finding.table +
+        '" - not even through a function that runs as the user.',
+      '',
+      'First tell me: is adding rows to "' + finding.table + '" meant to work for signed-in users? If only your ' +
+        'server adds them, change nothing.',
+      '',
+      'If users should be able to add them: give the rule a WITH CHECK that says who may - for example that ' +
+        'the user is a member of the row\'s organization (through your membership table or a helper) and that ' +
+        'the column naming who created it equals auth.uid(). Never use WITH CHECK (true): that lets anyone add ' +
+        'rows anywhere. Then add one row through the app to make sure it works.',
+    ]
     : finding.kind === 'privileged'
     ? [
       'My app may have a security problem - please check it rather than assume it.',
@@ -1166,7 +1262,23 @@ function fixPromptFor(finding) {
         'Then look for the same missing constraint on every other table and fix those too.',
       ],
     )
-    : finding.isView
+    : finding.asRole
+      ? [
+        'My app has a security problem.',
+        '',
+        'In "' + finding.table + '", anyone who is "' + finding.asRole + '" in their own ' + oneOf(finding.parent) + ' can read the rows ' +
+          'of every ' + oneOf(finding.parent) + '. I proved it on a copy: as "' + finding.asRole + '" of one ' + oneOf(finding.parent) +
+          ', I read ' + finding.readable + ' row(s) of another.',
+        '',
+        'A rule on "' + finding.table + '" checks the caller\'s role without tying it to the row - for example ' +
+          'exists (select 1 from ' + finding.via + ' m where m.' + finding.roleColumn + ' = \'' + finding.asRole + '\') with no ' +
+          'condition that m is the signed-in user\'s membership of THIS row\'s ' + oneOf(finding.parent) + '. Fix every rule on "' +
+          finding.table + '": a role check must say m.user_id = auth.uid() AND m.<' + oneOf(finding.parent) + ' id> = the row\'s ' +
+          oneOf(finding.parent) + ' id - or call a helper that does. Keep membership as the way in; do not replace it with USING (true).',
+        '',
+        'Then check every other rule and helper that checks a role for the same missing link.',
+      ]
+      : finding.isView
       ? [
         'My app has a security problem.',
         '',
@@ -1209,7 +1321,7 @@ function fixPromptFor(finding) {
 
 // Found and said, but never claimed as a break: the owner decides. Counted
 // apart in the report, never towards the exit code or a clean re-check.
-const TO_CHECK = ['privileged', 'role', 'teamread', 'bucket', 'searchpath', 'nullcheck'];
+const TO_CHECK = ['privileged', 'role', 'teamread', 'bucket', 'searchpath', 'nullcheck', 'noinsert'];
 // Functions, said by their name rather than a table's.
 const ON_A_FUNCTION = ['privileged', 'searchpath', 'conflict'];
 
@@ -1223,7 +1335,7 @@ function describe(finding) {
     // one the tool reasons about without executing, so it says so. The report
     // and the re-check both read this: a "verification required" finding is
     // never counted towards a clean re-check on its own.
-    status: TO_CHECK.includes(finding.kind) ? 'verification required' : 'confirmed',
+    status: TO_CHECK.includes(finding.kind) && !(finding.kind === 'role' && finding.promote) ? 'verification required' : 'confirmed',
     table: ON_A_FUNCTION.includes(finding.kind) ? finding.fn : finding.table,
     fn: finding.fn,
     args: finding.args,
@@ -1250,14 +1362,19 @@ function describe(finding) {
     readable: finding.readable,
     secrets: finding.secrets,
     bucket: finding.bucket,
+    rules: finding.rules,
     // An organization's rows read from outside it, and a member taking over
     // another member's row: kept so the re-check and the read-back word them
     // the same way the report did.
     tenant: finding.tenant,
+    asRole: finding.asRole,
     takeover: finding.takeover,
     personColumn: finding.personColumn,
+    promote: finding.promote,
+    toRole: finding.toRole,
     nullSlips: finding.nullSlips,
     noRule: finding.noRule,
+    writers: finding.writers,
     // Read from how a function or column is declared (scan.js searchPathsOf,
     // conflictsIn, emptyChoicesOf); kept so the read-back says it the same way.
     target: finding.target,
@@ -1272,6 +1389,9 @@ function describe(finding) {
         ') on the copy, and it refused. I did not call the function.'
       : finding.kind === 'nullcheck'
       ? 'I read that "' + finding.table + '.' + finding.column + '" may be NULL and has no default. I did not insert anything.'
+      : finding.kind === 'noinsert'
+      ? 'I read that every rule for adding rows to "' + finding.table + '" (' + listOf((finding.rules || []).map((r) => '"' + r + '"')) +
+        ') has neither USING nor WITH CHECK. I did not insert anything.'
       : finding.kind === 'recursive'
       ? 'Using ' + listOf((finding.reads || []).map((t) => '"' + t + '"')) + ' stopped with ' +
         loopError(finding) + '.'
@@ -1280,6 +1400,12 @@ function describe(finding) {
       : finding.kind === 'role' && finding.takeover
       ? 'As ' + aRole(finding.who) + ' who had just joined, I put my own id on the other person\'s row of "' +
         finding.via + '", which I could not touch before joining. It was undone.'
+      : finding.kind === 'role' && finding.promote
+      ? 'As ' + aRole(finding.who) + ' who had just joined, I set "' + finding.roleColumn + '" on my own row of "' +
+        finding.via + '" to "' + finding.toRole + '". It was undone.'
+      : finding.kind === 'crossed' && finding.asRole
+      ? 'As "' + finding.asRole + '" of my own ' + oneOf(finding.parent) + ', I read ' + finding.readable + ' row(s) of "' +
+        finding.table + '" belonging to another; with an ordinary role, none. My role was put back.'
       : finding.kind === 'role'
       ? 'As ' + aRole(finding.who) + ' who had just joined, I ' +
         listOf((finding.can || []).map((what) => {
@@ -1290,7 +1416,9 @@ function describe(finding) {
       ? 'As ' + aRole(finding.who) + ' who had just joined, I read ' + (finding.readable || 1) +
         ((finding.readable || 1) === 1 ? ' row' : ' rows') + ' of "' + finding.table + '" that I could not read before joining.'
       : finding.kind === 'bucket' && finding.noRule
-      ? 'I read that "' + finding.bucket + '" is public and that no rule says who may read it. I did not open any file.'
+      ? 'I read that "' + finding.bucket + '" is public and that no rule says who may read it' +
+        ((finding.writers || []).length ? ', while ' + listOf((finding.writers || []).map((r) => '"' + r + '"')) +
+          ' limit uploads and deletes to signed-in members' : '') + '. I did not open any file.'
       : finding.kind === 'bucket'
       ? 'I read that "' + finding.bucket + '" is public and that ' + listOf((finding.rules || []).map((r) => '"' + r + '"')) +
         ' says who may read it. I did not open any file.'
@@ -1398,7 +1526,7 @@ function describeAll(findings) {
   // Writes above reads: a table somebody emptied is worse than one they read.
   // A looping rule sits with the reads: it breaks the app for everyone it
   // fails for, which matters more than a duplicate or a stray row.
-  const byKind = { writable: 0, exposed: 1, crossed: 2, recursive: 2.5, conflict: 2.6, duplicated: 3, orphaned: 4, role: 4.5, teamread: 4.6, bucket: 4.7, privileged: 5, searchpath: 5.5, nullcheck: 6 };
+  const byKind = { writable: 0, exposed: 1, crossed: 2, recursive: 2.5, conflict: 2.6, duplicated: 3, orphaned: 4, role: 4.5, teamread: 4.6, bucket: 4.7, privileged: 5, searchpath: 5.5, noinsert: 5.7, nullcheck: 6 };
   const rank = (d) => (d.severity === 'CRITICAL' ? 0 : 1) * 10 + (byKind[d.kind] === undefined ? 9 : byKind[d.kind]);
   return described.sort((a, b) => rank(a) - rank(b));
 }

package/outside.js

@@ -79,12 +79,26 @@ async function discover(input, options) {
   if (!appUrl) throw problem('no-app', 'I need the address of your running app, e.g. https://your-app.example.com');
 
   const html = await getText(doFetch, appUrl);
-  const scripts = scriptUrls(html, appUrl);
   // The HTML itself sometimes carries the values (server-rendered apps do), so
   // it is searched too, before the bundles.
   let text = html;
-  for (const src of scripts) {
-    text += '\n' + await getText(doFetch, src).catch(() => '');
+  // The scripts the page loads, and the app's own modules those import - a
+  // page with no build step keeps its address and key in a config.js that
+  // app.js imports. Found on blind round 15: src/app.js did
+  // `import { SUPABASE_URL, SUPABASE_ANON_KEY } from "./config.js"`, and the
+  // URL mode said there was no Supabase here. Only the app's own address is
+  // followed, never a CDN, and only so far.
+  const origin = new URL(appUrl).origin;
+  const queue = scriptUrls(html, appUrl);
+  const seen = new Set(queue);
+  for (let i = 0; i < queue.length && i < MAX_SCRIPTS; i++) {
+    const body = await getText(doFetch, queue[i]).catch(() => '');
+    text += '\n' + body;
+    for (const next of importUrls(body, queue[i])) {
+      if (seen.has(next) || new URL(next).origin !== origin) continue;
+      seen.add(next);
+      queue.push(next);
+    }
   }
 
   const supabaseUrl = firstMatch(text, /https?:\/\/[a-z0-9-]+\.supabase\.co/i);
@@ -242,6 +256,31 @@ function scriptUrls(html, appUrl) {
   return dedupe(out);
 }
 
+// How many scripts a page and its own imports may add up to. A built app is a
+// handful; this stops a page that imports itself in circles, or a huge
+// unbundled tree, from being read without end.
+const MAX_SCRIPTS = 40;
+
+// The modules a script imports by a path - import ... from "./x.js",
+// export ... from "./x.js", import("./x.js") - made absolute against the
+// script's own address. A bare name ("react") is resolved by a bundler or an
+// import map, not by a path, so it is not one.
+function importUrls(source, scriptUrl) {
+  const out = [];
+  const re = /(?:\bfrom\s*|\bimport\s*\(\s*|\bimport\s+)["']([^"']+)["']/g;
+  let m;
+  while ((m = re.exec(String(source || '')))) {
+    const spec = m[1];
+    if (!/^(\.{1,2}\/|\/|https?:\/\/)/.test(spec)) continue;
+    try {
+      out.push(new URL(spec, scriptUrl).href);
+    } catch (err) {
+      /* not a path we can follow */
+    }
+  }
+  return dedupe(out);
+}
+
 function firstMatch(text, re) {
   const m = String(text).match(re);
   return m ? m[0] : null;
@@ -403,6 +442,7 @@ module.exports = {
   prowl: prowl,
   // exported for the checks
   scriptUrls: scriptUrls,
+  importUrls: importUrls,
   tableNames: tableNames,
   anonJwt: anonJwt,
   rangeCount: rangeCount,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kryptheon-night",
-  "version": "0.1.36",
+  "version": "0.1.38",
   "description": "Attacks a copy of your Supabase database and tells you in plain English what got in.",
   "license": "SEE LICENSE IN LICENSE",
   "type": "commonjs",
@@ -31,7 +31,7 @@
     "node": ">=18.0.0"
   },
   "scripts": {
-    "check": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node outside.check.js && node recheck.check.js && node untouched.check.js && node blocked.check.js && node orphans.check.js && node guests.check.js && node usable.check.js && node twin.check.js && node engines.check.js && node external.check.js && node schema.check.js && node collision.check.js && node tamper.check.js && node orphan.check.js && node shapes.check.js && node verdicts.check.js && node shop.check.js && node privileged.check.js && node recursion.check.js && node guarded.check.js && node nightly.check.js && node words.check.js && node helpers.check.js && node deeploop.check.js && node teams.check.js && node roles.check.js && node buckets.check.js && node cli.check.js && node loop.check.js && node report.check.js && node installscript.check.js && node tenants.check.js && node takeover.check.js && node checkfit.check.js && node declared.check.js",
+    "check": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node outside.check.js && node recheck.check.js && node untouched.check.js && node blocked.check.js && node orphans.check.js && node guests.check.js && node usable.check.js && node twin.check.js && node engines.check.js && node external.check.js && node schema.check.js && node collision.check.js && node tamper.check.js && node orphan.check.js && node shapes.check.js && node verdicts.check.js && node shop.check.js && node privileged.check.js && node recursion.check.js && node guarded.check.js && node nightly.check.js && node words.check.js && node helpers.check.js && node deeploop.check.js && node teams.check.js && node roles.check.js && node buckets.check.js && node cli.check.js && node loop.check.js && node report.check.js && node installscript.check.js && node tenants.check.js && node takeover.check.js && node elevated.check.js && node checkfit.check.js && node declared.check.js && node identity.check.js",
     "check:dry": "node package.check.js && node store.check.js && node trouble.check.js && node intro.check.js && node finding.check.js && node recheck.check.js && node outside.check.js",
     "check:package": "node package.check.js",
     "check:store": "node store.check.js",
@@ -78,7 +78,9 @@
     "check:installscript": "node installscript.check.js",
     "check:tenants": "node tenants.check.js",
     "check:takeover": "node takeover.check.js",
-    "check:checkfit": "node checkfit.check.js"
+    "check:checkfit": "node checkfit.check.js",
+    "check:identity": "node identity.check.js",
+    "check:elevated": "node elevated.check.js"
   },
   "keywords": [
     "supabase",

package/recheck.js

@@ -232,6 +232,7 @@ function whatOf(item) {
   if (item.kind === 'searchpath') return 'full rights, search_path not pinned';
   if (item.kind === 'conflict') return 'an upsert Postgres refuses';
   if (item.kind === 'nullcheck') return 'a ' + (item.column || 'value') + ' that can be left empty';
+  if (item.kind === 'noinsert') return 'no row can be added';
   return item.kind;
 }
 
@@ -315,6 +316,8 @@ function describe(result) {
         : item.kind === 'conflict'
         ? (elsewhere ? 'I asked Postgres to plan it here, and it accepted it.'
           : 'I asked Postgres to plan it again, and it accepted it.')
+        : item.kind === 'noinsert'
+        ? (elsewhere ? 'I looked here, and a rule for adding rows checks something.' : 'I looked again, and a rule for adding rows now checks something.')
         : item.kind === 'nullcheck'
         ? (elsewhere ? 'I looked here, and it cannot be left empty.' : 'I looked again, and it can no longer be left empty.')
         : item.kind === 'recursive'

package/scan.js

@@ -285,7 +285,7 @@ async function scan(client, sourceSchema, options) {
     // Surfaced, not swallowed. A table with no row in it reads as a safe
     // table, so the one thing that must never happen is reporting an app as
     // clear when part of it was never actually tried.
-    const notChecked = sown.skipped.slice();
+    const notChecked = sown.skipped.slice().concat(serverIdentityOf(plan));
 
     // A read that errored for any reason other than the table being closed to
     // that role decided nothing at all, and zero rows back from a failed query
@@ -419,7 +419,11 @@ async function scan(client, sourceSchema, options) {
     for (const fn of plan.anonFunctions || []) attempted.push('searchpath:' + fn.name);
     for (const fn of plan.functions || []) attempted.push('conflict:' + fn.name);
     for (const x of oneOfColumns(plan)) attempted.push('nullcheck:' + x.table + ':' + x.column.name);
-    const declared = searchPathsOf(plan).concat(refused, emptyChoicesOf(plan));
+    // Only a table that has a rule for adding rows was looked at for this.
+    for (const name of new Set((plan.policies || []).filter((p) => /^(INSERT|ALL)$/i.test(String(p.cmd || 'ALL'))).map((p) => p.table_name))) {
+      attempted.push('noinsert:' + name);
+    }
+    const declared = searchPathsOf(plan).concat(refused, emptyChoicesOf(plan), noInsertsOf(plan));
 
     // Storage buckets switched to public that also have a rule saying who may
     // read them. Read from the bucket settings and the rules, never a file.
@@ -573,6 +577,34 @@ const ONE_OF = /^CHECK \(+"?([A-Za-z_][\w$]*)"?\)?(?:::[\w ]+)? = ANY \(/;
  * fills the column: no default, not generated, and a CHECK that does not
  * mention NULL itself (a CHECK that does has decided the question).
  */
+/**
+ * Tables nobody can add a row to: every rule for adding rows is an INSERT
+ * rule written with neither USING nor WITH CHECK, which Postgres reads as
+ * "no" - measured on PostgreSQL 18, a bare `create policy p on t for insert
+ * to authenticated;` refuses every insert. A rule for ALL, or one with a
+ * check, is a way in, and the table is left alone. Mirrors no_insert_findings
+ * in engine.sql.
+ *
+ * Found on blind round 15 (Northstar Ops on Supabase): tickets_insert was
+ * written that way, so create_ticket failed for every user - the app's main
+ * feature - and nothing in the report said so.
+ */
+function noInsertsOf(plan) {
+  const byTable = new Map();
+  for (const p of (plan && plan.policies) || []) {
+    if (String(p.permissive || 'PERMISSIVE').toUpperCase() !== 'PERMISSIVE') continue;
+    const cmd = String(p.cmd || 'ALL').toUpperCase();
+    if (cmd !== 'INSERT' && cmd !== 'ALL') continue;
+    if (!byTable.has(p.table_name)) byTable.set(p.table_name, { bare: [], open: false });
+    const entry = byTable.get(p.table_name);
+    if (cmd === 'INSERT' && p.qual == null && p.with_check == null) entry.bare.push(p.name);
+    else entry.open = true;
+  }
+  return Array.from(byTable.keys()).sort()
+    .filter((table) => byTable.get(table).bare.length && !byTable.get(table).open)
+    .map((table) => ({ kind: 'noinsert', table: table, rules: byTable.get(table).bare.slice().sort(), columns: [] }));
+}
+
 function emptyChoicesOf(plan) {
   return oneOfColumns(plan)
     .filter((x) => !x.column.not_null && x.column.default_expr == null && !x.column.generated)
@@ -693,6 +725,44 @@ async function conflictsIn(client, into, plan, indexes) {
   return found;
 }
 
+/**
+ * The tables whose rules decide who is asking from a setting the app's own
+ * server sets - current_setting('app.tenant_id') - rather than from a
+ * Supabase sign-in. Each is a table NOT checked, said with the settings.
+ *
+ * Found on blind round 13 (Northstar Ops, Express on plain Postgres): every
+ * rule read app.tenant_id / app.user_id, which nothing here sets. Every attack
+ * ran as nobody, every one was refused for that reason alone, and the report
+ * said "Nothing got through" over a table whose rule was USING (true) - the
+ * one sentence this program must never print by accident. A rule that also
+ * asks Supabase (auth.uid(), request.jwt...) is attacked as usual.
+ * Mirrors server_identity in engine.sql.
+ */
+function serverIdentityOf(plan) {
+  const byTable = new Map();
+  for (const p of (plan && plan.policies) || []) {
+    const text = String(p.qual || '') + ' ' + String(p.with_check || '');
+    if (/\bauth\s*\.\s*(uid|jwt|role|email)\s*\(|request\.jwt/i.test(text)) continue;
+    const re = /current_setting\s*\(\s*'([^']+)'/gi;
+    let m;
+    while ((m = re.exec(text))) {
+      if (/^request\./i.test(m[1])) continue;
+      if (!byTable.has(p.table_name)) byTable.set(p.table_name, new Set());
+      byTable.get(p.table_name).add(m[1]);
+    }
+  }
+  return Array.from(byTable.keys()).sort().map((table) => {
+    const settings = Array.from(byTable.get(table)).sort();
+    // The why is short and per table; what it means is said once, under the
+    // list (notTestedLines), not repeated for every table.
+    return {
+      table: table,
+      why: 'its rules decide who is asking with ' + andList(settings.map((s) => "current_setting('" + s + "')")),
+      identity: true,
+    };
+  });
+}
+
 /**
  * The app's functions that were read and never called: anything a visitor or
  * a signed-in user can call, that no rule calls for them (those ran with every
@@ -707,7 +777,7 @@ function notCalledOf(plan, findings) {
   const rules = ((plan && plan.policies) || []).map((p) => String(p.qual || '') + ' ' + String(p.with_check || '')).join(' ');
   const named = new Set((findings || []).map((f) => f.fn).filter(Boolean));
   const names = ((plan && plan.functions) || [])
-    .filter((fn) => fn.client_callable === true && !named.has(fn.name))
+    .filter((fn) => fn.client_callable === true && fn.from_extension !== true && !named.has(fn.name))
     .map((fn) => fn.name)
     .filter((name) => !new RegExp('(^|[^A-Za-z0-9_$])"?' + escape(name) + '"?\\s*\\(').test(rules));
   return Array.from(new Set(names)).sort();
@@ -735,18 +805,35 @@ function bucketsOf(plan) {
       .replace(/\btrue\b|\band\b|[()\s]/gi, '');
     return !toEveryone || rest !== '';
   };
-  return ((plan && plan.buckets) || []).filter((b) => b.public).map((b) => ({
-    kind: 'bucket',
-    table: b.name,
-    bucket: b.id,
-    rules: (b.readRules || []).filter((rule) => narrows(rule, b.id)).map((rule) => rule.name),
-    // No read rule at all, and a name that says what is in it is not for
-    // everyone. Found on a blind test (HarborLine): customer-exports was
-    // public, and its one read rule had failed to load (a text compared to a
-    // uuid) - with nothing to read, the bucket was never mentioned.
-    noRule: !(b.readRules || []).length && PRIVATE_BUCKET.test(String(b.name)),
-    columns: [],
-  })).filter((f) => f.rules.length || f.noRule);
+  // A rule for putting files in or taking them out that only signed-in people
+  // pass AND that looks a file up in the app's own data (a subquery over a
+  // table: an attachments row, a membership). That is files the app treats as
+  // its members' records. A rule that only asks whose folder it is - the
+  // usual public avatars bucket - is not this.
+  const membersOnly = (rule) => {
+    const roles = schema.roleList(rule.roles);
+    const text = String(rule.qual || '') + ' ' + String(rule.with_check || '');
+    const open = roles.includes('anon') || roles.includes('public');
+    return (!open || /\bauth\s*\.\s*(uid|jwt)\s*\(/i.test(text)) && /\bfrom\s+/i.test(text);
+  };
+  return ((plan && plan.buckets) || []).filter((b) => b.public).map((b) => {
+    const writers = (b.writeRules || []).filter(membersOnly).map((rule) => rule.name);
+    return {
+      kind: 'bucket',
+      table: b.name,
+      bucket: b.id,
+      rules: (b.readRules || []).filter((rule) => narrows(rule, b.id)).map((rule) => rule.name),
+      // No read rule at all, and something else saying its files are not for
+      // everyone: a name that says what is in it (HarborLine: customer-exports,
+      // whose one read rule had failed to load), or rules that let only
+      // signed-in members put files in or take them out (blind round 15:
+      // workspace-files, written only through an attachments row of the
+      // uploader's, and readable by anyone with a link).
+      noRule: !(b.readRules || []).length && (PRIVATE_BUCKET.test(String(b.name)) || writers.length > 0),
+      writers: !(b.readRules || []).length ? writers : [],
+      columns: [],
+    };
+  }).filter((f) => f.rules.length || f.noRule);
 }
 
 // Names that say a bucket's files are somebody's own business. Whole words
@@ -915,8 +1002,17 @@ function notTestedLines(result) {
     lines.push('    Every table I could reach was attacked, and every attack I have');
     lines.push('    finished, ran.');
   } else {
+    // Wrapped: a reason can be a sentence or two (serverIdentityOf), and an
+    // unwrapped one ran off the side of the terminal and the dashboard.
     for (const missed of notChecked) {
-      lines.push('    ' + missed.table + ' - ' + missed.why);
+      wrap(missed.table + ' - ' + missed.why, 66).forEach((l, i) => lines.push((i ? '      ' : '    ') + l));
+    }
+    if (notChecked.some((missed) => missed.identity)) {
+      lines.push('');
+      wrap('Those settings are set by your own server, not by a Supabase sign-in. I sign in the way Supabase ' +
+        'does, so every attack on those tables ran as nobody, and being refused proves nothing about them. ' +
+        'Check those rules by hand, or test them with your server setting who is asking.', 66)
+        .forEach((l) => lines.push('    ' + l));
     }
     lines.push('');
     lines.push('    These are unknown, not clear. An attack that never ran comes back');
@@ -1196,11 +1292,13 @@ module.exports = {
   privilegedOf: privilegedOf,
   searchPathsOf: searchPathsOf,
   emptyChoicesOf: emptyChoicesOf,
+  noInsertsOf: noInsertsOf,
   oneOfColumns: oneOfColumns,
   conflictTargetsOf: conflictTargetsOf,
   partialWhereFor: partialWhereFor,
   conflictsIn: conflictsIn,
   notCalledOf: notCalledOf,
+  serverIdentityOf: serverIdentityOf,
   bucketsOf: bucketsOf,
   loopingTables: loopingTables,
   taggerFor: taggerFor,

package/schema.js

@@ -387,6 +387,11 @@ async function readFunctions(client, schema) {
             pg_get_functiondef(p.oid) AS def,
             pg_get_function_identity_arguments(p.oid) AS args,
             p.proacl IS NULL AS default_acl,
+            -- Installed by an extension (pgcrypto's crypt(), digest() ...):
+            -- not something the app wrote, so never listed as "your app's
+            -- functions" (blind round 13 listed 23 of pgcrypto's).
+            EXISTS (SELECT 1 FROM pg_depend d
+                     WHERE d.classid = 'pg_proc'::regclass AND d.objid = p.oid AND d.deptype = 'e') AS from_extension,
             -- Whether the app can call it at all, as a visitor or signed in.
             -- Such a function is something the app does that was read and
             -- never run - said under "What I did not test" (scan.js notCalledOf).
@@ -449,7 +454,18 @@ const BUCKETS_QUERY =
                             FROM pg_policies p
                            WHERE p.schemaname = 'storage' AND p.tablename = 'objects'
                              AND p.cmd IN ('SELECT', 'ALL')
-                             AND position(quote_literal(b.id::text) IN coalesce(p.qual, '')) > 0)
+                             AND position(quote_literal(b.id::text) IN coalesce(p.qual, '')) > 0),
+            -- The rules for putting files in and taking them out: who the app
+            -- lets write a bucket says who its files are for (scan.js bucketsOf).
+            'writeRules', (SELECT coalesce(jsonb_agg(jsonb_build_object(
+                                   'name', p.policyname::text,
+                                   'roles', to_jsonb(p.roles::text[]),
+                                   'qual', p.qual,
+                                   'with_check', p.with_check) ORDER BY p.policyname), '[]'::jsonb)
+                            FROM pg_policies p
+                           WHERE p.schemaname = 'storage' AND p.tablename = 'objects'
+                             AND p.cmd IN ('INSERT', 'UPDATE', 'DELETE', 'ALL')
+                             AND position(quote_literal(b.id::text) IN coalesce(p.qual, '') || ' ' || coalesce(p.with_check, '')) > 0)
           ) ORDER BY b.id), '[]'::jsonb) AS buckets
      FROM storage.buckets b`;
 

package/tamper.js

@@ -297,7 +297,10 @@ function roleColumnOf(table) {
     // the order reads are tried in, so the least trusted one that can read a
     // secret is the one named.
     const ladder = [lowest].concat(labels.filter((label) => label !== lowest && !IN_CHARGE.test(label)).reverse());
-    if (lowest) return { column: column.name, type: column.type, lowest: lowest, ladder: ladder };
+    // The role at the top: an owner if there is one, else the first in charge.
+    const top = labels.find((label) => /owner/i.test(label)) || labels.find((label) => IN_CHARGE.test(label)) || null;
+    const inCharge = labels.filter((label) => IN_CHARGE.test(label));
+    if (lowest) return { column: column.name, type: column.type, lowest: lowest, ladder: ladder, top: top, inCharge: inCharge };
   }
   return null;
 }
@@ -334,7 +337,7 @@ function memberships(tables) {
       .filter((key) => key.refTable !== table.name && names.has(key.refTable) && !key.columns.includes(person));
     if (!keys.length || aloneUnique(table, person)) continue;
     found.push({ table: table, person: person, role: role.column, roleType: role.type, lowest: role.lowest,
-      ladder: role.ladder, keys: keys });
+      ladder: role.ladder, top: role.top, inCharge: role.inCharge || [], keys: keys });
   }
   // A table named for members first: it is the one a team rule asks.
   const named = (m) => (/member/i.test(m.table.name) ? 0 : 1);
@@ -343,7 +346,7 @@ function memberships(tables) {
 
 // What each kind of write is called in a rule.
 // A takeover is an UPDATE too: a rule for updating is what it would hide behind.
-const COMMAND = { add: 'INSERT', change: 'UPDATE', delete: 'DELETE', takeover: 'UPDATE' };
+const COMMAND = { add: 'INSERT', change: 'UPDATE', delete: 'DELETE', takeover: 'UPDATE', promote: 'UPDATE' };
 
 /**
  * Whether the app's own rules name this role among those allowed to make
@@ -502,6 +505,21 @@ async function teammate(client, schema, tables, seeded, rules) {
           statement: 'UPDATE ' + target + ' SET ' + quote(member.person) + " = '" + attack.USER_B + "' WHERE " + firstPersons.join(' AND '),
           values: [],
         });
+        // Their own membership row, given the role at the top. Found on blind
+        // round 15 (Northstar Ops on Supabase): memberships_update checked only
+        // user_id = auth.uid(), so a viewer set their own role to 'owner'.
+        // Before joining they have no row, so only what joining added counts.
+        if (member.top) {
+          const ownRow = [quote(member.person) + " = '" + attack.USER_B + "'"]
+            .concat(Object.keys(pointed).map((name) => quote(name) + " = '" + String(pointed[name]).split("'").join("''") + "'"));
+          moves.push({
+            what: 'promote',
+            anyRole: true,
+            statement: 'UPDATE ' + target + ' SET ' + quote(member.role) + " = '" + String(member.top).split("'").join("''") +
+              "' WHERE " + ownRow.join(' AND '),
+            values: [],
+          });
+        }
       }
       // Adding a row to the team, said only of a role whose own name says it
       // may only look: a member adding rows is the feature, a viewer adding
@@ -591,12 +609,60 @@ async function teammate(client, schema, tables, seeded, rules) {
             below: below.slice(),
             columns: (table.columns || []).map((c) => c.name),
             rlsEnabled: table.rlsEnabled,
-          }, can.includes('takeover') ? { takeover: true, personColumn: member.person } : {}));
+          }, can.includes('takeover') ? { takeover: true, personColumn: member.person } : {},
+          can.includes('promote') ? { promote: true, toRole: member.top } : {}));
           break;
         }
         if (!listed) below.push(role);
       }
 
+      // In charge of their OWN team, reading the first person's. Found on
+      // blind round 15 (Northstar Ops on Supabase): projects_select let in
+      // anyone for whom `exists (select 1 from memberships m where m.role =
+      // 'admin')` - not tied to the project's organization - so an admin of
+      // any organization read every organization's projects. The second
+      // person's own membership is given each role in charge, one at a time,
+      // and the first person's team's rows are asked for; only what the role
+      // added counts. A table that names neither the team nor a person is
+      // not asked.
+      const theirTeam = Object.keys(pointed).length
+        ? Object.keys(pointed).map((name) => quote(name) + " = '" + String(pointed[name]).split("'").join("''") + "'").join(' AND ')
+        : owner ? quote(owner) + " = '" + attack.USER_A + "'" : null;
+      if (theirTeam && member.inCharge.length) {
+        const look = 'SELECT 1 FROM ' + target + ' WHERE ' + theirTeam;
+        const plain = counted(await tryWrite(client, 'authenticated', attack.USER_B, look, []));
+        for (const label of member.inCharge) {
+          const key = 'elevated:' + table.name + ':' + label;
+          const raise = {
+            statement: 'UPDATE ' + quote(schema) + '.' + quote(member.table.name) + ' SET ' + quote(member.role) + ' = $1 WHERE ' +
+              quote(member.person) + ' = $2',
+            values: [label, attack.USER_B],
+          };
+          const now = counted(await tryWrite(client, 'authenticated', attack.USER_B, look, [], raise));
+          if (plain === null || now === null) {
+            blocked.push({ table: table.name, key: key, why: 'as "' + label + '" in their own ' + parent + ' row: reading it failed' });
+            break;
+          }
+          completed.push(key);
+          if (now > plain) {
+            findings.push({
+              kind: 'crossed',
+              table: table.name,
+              owner: owner || Object.keys(pointed).sort()[0],
+              tenant: !owner,
+              readable: now - plain,
+              asRole: label,
+              via: member.table.name,
+              roleColumn: member.role,
+              parent: parent,
+              columns: (table.columns || []).map((c) => c.name),
+              rlsEnabled: table.rlsEnabled,
+            });
+            break;
+          }
+        }
+      }
+
       // Reading what a member should not see, said only of a table holding a
       // secret. Every role not in charge, from the lowest up; the first that
       // can read is the one named. A member reading their team's ordinary